'Shamoon' Malware Steals Data, Cripples PCs

A newly discovered type of malware is designed to avoid detection by severely damaging a victim's computer once it has harvested sensitive data.

The new 'Trojan horse' software is called "Shamoon" by most antivirus companies. It focuses on grabbing information housed in the 'Users', 'Documents and Settings', 'System32/Drivers' and 'System32/Config' folders on Windows systems.

While this new piece of malware is primarily designed to attack large businesses, some of them specifically by name, it will apparently target home users, as well.

Malware Packs Two-Fisted Punch

Shamoon is unique in its innovative maliciousness: it packs a two-fisted punch by first infecting a computer connected to the Internet and using the machine to communicate to the malware's command-and-control server.

Then it tries to infect other computers on the network and steal information.

Finally, it disables the infected machines by overwriting various files and the Master Boot Record (MBR), and transmits the data it has stolen back to its server via that first infected computer. (Source: zdnet.com)

Malware rarely destroys or wipes out a computer's MBR. Rather, most threats work quietly to avoid detection for as long as possible.

Aviv Raff, CTO and co-founder of Israeli security company Seculert, says making a PC unbootable following an attack shows the people behind Shamoon are "looking for new ways to cover their tracks". (Source: computerworld.com)

Kaspersky Lab: Shamoon a Stuxnet Copycat

Russian computer security experts at Kaspersky Lab have also weighed in on this issue, claiming they haven't identified who is behind the malware, but they are fairly certain there is no direct connection between Shamoon and the Stuxnet data-wiping worm that hit Iran last April.

"It is more likely that (Shamoon) is a copycat," wrote a Kaspersky researcher in a recent post, "the work of script kiddies inspired by the earlier story." (Source: computerworld.com)